DGR-027 evidence — exact llama.cpp provenance manifest and fetch workspace

Completed implementation: 2026-07-17
Branch: ralph/dgr-small-terra
Authority: live Gitea issue #11. The controller fetched and claimed the issue through the Gitea API before launch; the isolated agent received that exact body.

Changed files

packages/node/native/llama/UPSTREAM_LOCK.json
packages/node/native/llama/PATCH-STACK.md
scripts/llama_cpp_dependency.py
tests/test_llama_cpp_dependency.py
.scratch/distributed-gguf-runtime/evidence/DGR-027/README.md

Provenance and retrieval contract

UPSTREAM_LOCK.json records the upstream Git URL, immutable 40-character commit e920c523e3b8a0163fe498af5bf90df35ff51d25, expected Git tree 6c91a11407a3a3fb160f5dac705f9c59718f54f1, MIT license, and the sole retrieval method: git-clone-detached-commit into build/llama.cpp/source.

python3 scripts/llama_cpp_dependency.py fetch has no branch, tag, ref, or repository override. On a first fetch it clones the manifest URL, checks out the detached commit, and verifies commit, tree, required upstream blobs, license, and cleanliness. If the workspace already exists, it makes no network request and accepts it only after the same verification. Dirty or mismatched caches fail closed. The build directory is already ignored by .gitignore.

Verification

Command	Result
`python3 -m pytest -q tests/test_llama_cpp_dependency.py`	`7 passed in 0.22s`
`python3 -m compileall packages tests`	passed
`git diff --check`	passed (no output)
`python3 scripts/llama_cpp_dependency.py inspect`	passed; reports exact commit/tree, retrieval workspace, MIT license, and two-patch stack
`python3 scripts/llama_cpp_dependency.py fetch --workspace /tmp/not-llama-workspace`	failed closed with status 2: workspace outside the locked ignored build root
symlinked workspace regression	passed; both a `build/` ancestor symlink and a final `source` symlink escaping the repository are refused
attached-branch cache regression	passed; an exact commit on a local branch is refused until checked out as detached HEAD
ignored/excluded injection regression	passed; a file hidden by `.git/info/exclude` is detected and refused
tracked injection regression	passed; modified tracked content hidden by both `assume-unchanged` and `skip-worktree` is content-hashed and refused
executable-mode regression	passed on the POSIX fixture for both index flags; the mounted project workspace has `core.filemode=false`, so its exact index tree is the canonical mode record and physical mode bits are not treated as meaningful
`git check-ignore -v build/llama.cpp/source`	passed; `.gitignore:6:build/`
`git diff --summary` and `git ls-files build packages/node/native/llama`	no source checkout or new submodule introduced; only manifest/docs/patches/native wrapper are tracked
`python3 scripts/llama_cpp_dependency.py fetch` (controller network lane)	passed; fetched the exact detached commit and verified HEAD `e920c523e3b8a0163fe498af5bf90df35ff51d25` and tree `6c91a11407a3a3fb160f5dac705f9c59718f54f1` in the ignored workspace
`python3 scripts/llama_cpp_dependency.py apply --source-dir build/llama.cpp/source`	failed on the pre-existing `0002-dense-llama-owned-range-loader.patch` as a corrupt patch at line 26; this is an explicit DGR-028 blocker and no native-build claim is made

The targeted test suite creates a local Git fixture to prove offline cache reuse after full identity verification, then proves a dirty cache is rejected. It also proves the CLI rejects a repository/branch override and an arbitrary workspace.

Limitations

The controller successfully materialized and verified the exact upstream commit/tree, so the DGR-027 fetch and offline-cache boundary has real upstream evidence rather than fixture-only evidence.
The existing 0002-dense-llama-owned-range-loader.patch is malformed and cannot pass git apply --check against the exact pin. DGR-027 changes no patch file; repairing and certifying the numbered patch stack belongs to DGR-028. Until that story closes, the repository must not claim patched-tree, native CMake/CTest, or reverse-apply certification.
No model, API credits, GPU, or model artifact storage was used.

Dependency handoff

DGR-028, DGR-029, and DGR-044 must invoke the manifest-owned fetch command before touching llama.cpp source. They may use only the verified build/llama.cpp/source checkout and must record any native build, CTest, and patch apply/check/reverse evidence against the exact manifest pin. DGR-017's cleanup remains provenance only and grants no inherited completion credit.